What data we process and what we do with it
In short: the minimum needed to provide the service, for as long as necessary, without passing it to anyone and without training models on it.
This English version is provided for convenience. In case of any discrepancy, the Spanish version prevails.
Controller
Biomag S.L.U., Vitoria-Gasteiz (Álava), Spain. Full details in the legal notice. For any privacy matter, write to the address shown there.
What we process, why, and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Email and login details | Provide your account and authenticate you | Performance of the contract |
| Questions and documents you provide | Provide the service | Performance of the contract |
| Billing data | Charge and issue invoices | Legal obligation |
| Technical usage logs | Security and fault detection | Legitimate interest |
What we do NOT do
- We do not train models on your content, nor pass your data to third parties for that purpose.
- We do not sell data to anyone, nor use it for advertising.
- We do not keep the text of the free first diagnosis. What you write is used only to answer you; our log keeps an anonymous technical fingerprint, not your text.
- We do not keep the text you check. When you check the citations of a document, we store its SHA-256 fingerprint and the result, not the text.
How long
Query logs are purged automatically after the configured retention window (365 days by default), by a daily process with no human intervention. Billing data is kept for the period required by tax law. If you close your account, the rest is deleted.
Who else sees it
Only technical providers, under contract and on our behalf: hosting (EU), language models with zero retention where the provider offers it, and email delivery. The full list, with each provider's role and location, is in the data processing agreement.
Payments are processed by Paddle.com Market Limited, the Merchant of Record for our orders, which processes payment and billing data as an independent controller. The checkout page loads its form from Paddle's servers; nothing from outside is loaded anywhere else on the site.
Transfers outside the European Economic Area rely on standard contractual clauses approved by the European Commission.
Your rights
You can access, rectify, erase, object to, restrict and port your data. Export is available in the application itself, without asking. For everything else, write to us: we reply within one month at most. If you are not satisfied, you may complain to the Spanish Data Protection Agency (AEPD).
Cookies
We only use the cookies needed to keep you logged in. We do not use advertising or third-party tracking cookies. To understand how the site is used we count visits to some pages in aggregate, per day —"so many visits today"—, without cookies, without your IP address and without any data that identifies you, so there is nothing to consent to and no banner to accept.
Security
Encryption in transit and at rest, access control by organisation and role, and isolation between clients verified by automated tests at every deployment. See security and trust.
Last updated: 27 September 2026 · Biomag S.L.U.